Under the GDPR, which essential pieces of information must be provided to data subjects before collecting their personal data?

• A. The authority by which the controller is collecting the data and the third parties to whom the data will be sent.
• B. The identity and contact details of the controller and the reasons the data is being collected.
• C. The contact information of the controller and a description of the retention policy.
• D. The name/s of relevant government agencies involved and the steps needed for revising the data.

Which GDPR principle would a Spanish employer most likely depend upon to annually send the personal data of its employees to the national tax authority?

• A. The legal obligation of the employer.
• B. The protection of the vital interest of the employees.
• C. The consent of the employees.
• D. The legitimate interest of the public administration.

SCENARIO
Please use the following to answer the next question:
Building Block Inc. is a multinational company, headquartered in Chicago with offices throughout the United States, Asia, and Europe (including Germany, Italy, France and Portugal). Last year the company was the victim of a phishing attack that resulted in a significant data breach. The executive board, in coordination with the general manager, their Privacy Office and the Information Security team, resolved to adopt additional security measures. These included training awareness programs, a cybersecurity audit, and use of a new software tool called SecurityScan, which scans employees' computers to see if they have software that is no longer being supported by a vendor and therefore not getting security updates. However, this software also provides other features, including the monitoring of employees' computers.
Since these measures would potentially impact employees, Building Block's Privacy Office decided to issue a general notice to all employees indicating that the company will implement a series of initiatives to enhance information security and prevent future data breaches.
After the implementation of these measures, server performance decreased. The general manager instructed the Security team on how to use SecurityScan to monitor employees' computers activity and their location.
During these activities, the Information Security team discovered that one employee from Italy was daily connecting to a video library of movies, and another one from Germany worked remotely without authorization. The Security team reported these incidents to the Privacy Office and the general manager. In their report, the team concluded that the employee from Italy was the reason why the server performance decreased.
Due to the seriousness of these infringements, the company decided to apply disciplinary measures to both employees, since the security and privacy policy of the company prohibited employees from installing software on the company's computers, and from working remotely without authorization.
To comply with the GDPR, what should Building Block have done as a first step before implementing the SecurityScan measure?

• A. Assessed potential privacy risks by conducting a data protection impact assessment.
• B. Consulted with the relevant data protection authority about potential privacy violations.
• C. Distributed a more comprehensive notice to employees and received their express consent.
• D. Consulted with the Information Security team to weigh security measures against possible server impacts.

Under the GDPR, which of the following is true in regard to adequacy decisions involving cross-border transfers?

• A. The European Commission can adopt, repeal or amend an existing adequacy decision.
• B. EU member states are vested with the power to accept or reject a European Commission adequacy decision.
• C. To be considered as adequate, third countries must implement the EU General Data Protection Regulation into their national legislation.
• D. The European Commission can adopt an adequacy decision for individual companies.

What is the most frequently used mechanism for legitimizing cross-border data transfer?

• A. Standard Contractual Clauses.
• B. Binding Corporate Rules.
• C. Derogations.
• D. Approved Code of Conduct.